GDPR for sports federations: what you must comply with for your members' data

A sports federation handles some of the most sensitive personal data that exists: national IDs, birth dates of minors, medical records, photographs, signatures. And it does so at scale: a regional federation may end up custodian to tens of thousands of individuals’ data.

GDPR (EU Regulation 2016/679) and its national implementations apply to a federation with the same intensity as to a bank. The difference is that the bank has a compliance department and the federation usually has a part-time secretary. This guide summarizes what you must comply with, without unnecessary jargon.

This guide is informative and does not replace personalized legal advice. For specific questions, consult your data protection officer or a specialized firm.

The six GDPR principles applied to a federation

GDPR rests on six principles. Let’s look at them through a federation lens:

1. Lawfulness, fairness and transparency. You can only process data if you have a clear legal basis (federation contract, legal obligation, consent…) and if you communicate it honestly to the data subject.
2. Purpose limitation. License data cannot be used for, say, commercial campaigns from a sponsor without additional consent.
3. Data minimization. If you don’t use postal address for anything, don’t ask for it. If you never use a member’s occupation, remove the field from the form.
4. Accuracy. Data must be kept up to date. You need a procedure for members to correct their data without calling you.
5. Storage limitation. You cannot keep data indefinitely. Set retention periods by data type.
6. Integrity and confidentiality. Data must be protected against unauthorized access, loss and alteration.

Data categories you handle (and their risk)

Not all data weighs the same. GDPR distinguishes between ordinary data and special categories with reinforced protection. Both coexist in a federation:

Data type	Examples	GDPR risk
Identifying	Name, national ID, address, phone, email	Medium
Financial	IBAN, payment history	High
Images	Card photo, competition images	High (especially for minors)
Health	Medical certificates, check-ups, injuries	Special category — very high
Minors’ data	All of the above when subject is <14	Reinforced

Medical data and minors’ data require reinforced technical and organizational measures: encryption at rest, access logs, explicit parental consent.

Lawful bases: why can you process that data?

Many federations make the mistake of relying on consent for everything. It is the most fragile basis (it can be withdrawn at any time). In reality, almost all federation processing rests on other, more solid bases:

• Performance of a contract (or associative relationship). The federation license creates an almost-contractual relationship; processing data needed to issue, manage and renew it falls under this basis.
• Compliance with a legal obligation. Sports legislation, anti-doping rules, tax obligations: all require processing specific data.
• Legitimate interest. For IT security, fraud prevention, internal audits.
• Consent. Reserved for what cannot be justified by another basis: commercial newsletter, image release for marketing, third-party campaigns.

The operational key: record which legal basis supports each processing activity in your record of processing activities (RoPA). If an inspection comes, that table is the first thing they’ll ask for.

The record of processing activities (RoPA)

It is mandatory if you process data at scale or special categories, and a federation meets both. The RoPA is an internal document listing all your processing activities and answering, for each one:

• Purpose (e.g. “issuance and renewal of licenses”).
• Categories of data subjects (e.g. “adult members”, “minor members”, “technicians”).
• Categories of data (e.g. “identifying, financial, health”).
• Recipients (clubs, national federation, insurance, tax authorities).
• Retention periods.
• Technical and organizational security measures.
• International transfers (if any).

It is not a document that gets published: it is internal, but must be up to date and available for the supervisory authority if requested.

The obligations most often forgotten

Out of the 99 GDPR articles, there are five points federations tend to neglect:

1. Information to the data subject at sign-up

The sign-up or renewal form must show, before signature, information about who processes the data, for what purpose, on what basis, to whom it is transferred and how to exercise rights. It doesn’t count if you hide it in a 20-page PDF nobody reads.

2. Parental consent for under-14s

For minors, it is not enough that a parent signs the license: there must be specific consent to data processing. If you share the minor’s images on social media or in a publication, you need additional explicit consent.

3. Right of access within 30 days

If a member requests a copy of all their data, you have one month to reply with all the information in a portable format. If your Excel is spread across 5 secretaries, meeting that deadline is a real challenge.

4. Breach notification within 72 hours

If there is a security breach (email sent to the wrong person with a database attached, stolen laptop, leaked database), you must notify the supervisory authority within 72 hours. Having a written protocol in advance saves you from panic.

5. Data processors (vendors)

Your software provider, your email service, your payment gateway: all are data processors. You need to sign a specific contract (art. 28) with each one detailing what they may and may not do with the data. Requesting it proactively is good practice.

Data Protection Officer (DPO)

Regional and national federations, given their volume and sensitivity, should appoint a DPO — internal or external. It is not always strictly mandatory, but supervisory authorities strongly recommend it. A small federation can share a DPO with other entities in its group.

The DPO is not the one who solves problems: they advise, audit and act as liaison with the supervisory authority. Their role must be published on the website and communicated to the Agency.

How software helps (and how Excel sinks you)

Working with Excel against GDPR is nearly impossible:

• It doesn’t log accesses or changes (no traceability).
• It gets copied by email and saved in forgotten folders (hard to audit).
• It doesn’t encrypt data at rest.
• It doesn’t enable structured exports per person for access requests.
• It doesn’t implement field-level permissions.

A well-built federation software gives you, out of the box:

• Audit logs (who saw or changed what, and when).
• Encryption at rest and in transit (mandatory HTTPS, encrypted database).
• Per-person export with one click for access rights.
• Granular roles and permissions.
• Daily backup with retention period.
• EU hosting, with signed processor agreements.

Quick checklist

Before year-end, review:

• I have an up-to-date RoPA covering all processing activities.
• Every form shows Article 13 information before signature.
• I collect separate consents for newsletter and images.
• I have a written procedure for access and erasure rights.
• My software vendors have signed processor agreements.
• I have a written breach notification protocol.
• All data is hosted in the EU.
• I have a designated DPO, communicated to the supervisory authority (if applicable).

Compliance isn’t a formality. It is the quality stamp of a serious federation, and it is also a competitive advantage when clubs compare options.